Day15 Kubernetes 安全遠程操控術(二)：Teleport 讓你的集群隨叫隨到

2024 iThome 鐵人賽

DAY 15

Kubernetes

異世界生存戰記：30天煉成GKE大師系列第 15 篇

16th鐵人賽 teleport k8s gke kubernete

andrewchen930511

2024-09-29 03:24:29

197 瀏覽

分享至

前言

上篇文章建立了 Teleport Auth 和 Proxy，已經可以連接到 VM 了。這個章節會示範連接到 GKE 叢集，結合 K8s 內的 RBAC 來進行權限控管，將 Teleport 的強大之處展示給大家。

安裝Teleport Agent來和Teleport Cluster綁定

$ helm pull teleport/teleport-kube-agent --version 16.3.0
$ tar zxvf teleport-kube-agent-16.3.0.tgz

進入昨天架設好的 Teleport 網頁，點擊 Enroll New Resource > Self-Hosted Kubernetes

我們要將這個叢集註冊上去，需要安裝 Teleport-Agent 在此叢集內

我們將此 GKE 叢集命名為 ithome-202409-demo-2_demo2-cluster ，點擊 NEXT

會出現 Step3，將其中的 roles, authToken, proxyAddr, kubeClusterName, labels 更改至 Helm Chart Values.yaml，且另外幫這個叢集打上標籤 env:demo2-cluster

labels:
  env: demo2-cluster

$ helm upgrade --install teleport-agent -f values.yaml . -n teleport --create-namespace

teleport-agent Pods 正常啟動後， Teleport Web UI 會顯示 Successfully detected your new Kubernetes cluster. ，點擊 NEXT

示範創建一個權限只有讀取此 GKE 叢集的 ClusterRole

在此 GKE 集群內創建一個 ClusterRole 及 ClusterRoleBinding，此 Group:“developer-readonly” 設定為只有讀取權限，無法刪除任何物件，且看不到敏感資訊(Secret)，Group:“developer-readonly” 綁定 ClusterRole:“readonly”

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly
rules:
  - apiGroups: [""]
    verbs: ["get", "list", "watch"]
    resources:  [
      "configmaps","endpoints","persistentvolumeclaims","persistentvolumeclaims/status","pods","nodes",
      "replicationcontrollers","replicationcontrollers/scale","serviceaccounts",
      "services","services/status","events","bindings","events","limitranges","namespaces/status",
      "pods/log","pods/status","replicationcontrollers/status",
      "resourcequotas","resourcequotas/status","namespaces"
      ]
  - apiGroups: ["apps"]
    verbs: ["get","list","watch"]
    resources: [
      "controllerrevisions","daemonsets","daemonsets/status","deployments",
      "deployments/scale","deployments/status","replicasets","replicasets/scale","replicasets/status",
      "statefulsets","statefulsets/scale","statefulsets/status"
      ]
  - apiGroups: ["autoscaling"]
    verbs: ["get","list","watch"]
    resources: ["horizontalpodautoscalers","horizontalpodautoscalers/status"]
  - apiGroups: ["batch"]
    verbs: ["get","list","watch"]
    resources: ["cronjobs","cronjobs/status","jobs","jobs/status"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: readonly-binding
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: developer-readonly
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: readonly

在 Teleport UI 頁面創建 ClusterRoleBinding 使用的 Group: “developer-readonly”，如果讀者想要建立的是 User 也可以，只需要改成在 K8s 內建立 Role 及 RoleBinding，關於 K8s 的 RBAC 這裡就不進行詳述了。

點擊 NEXT

在 Step2 選擇剛剛創建的 Group: “developer-readonly”，在 Step3 點擊 Test，可以檢查剛剛創建的 Group 是否有正確綁定到 ClusterRole 的權限，確定設定都正確後點擊 Finish。

回到首頁，會看到多了一個新的 K8s 叢集（ithome-202409-demo-2_demo2-cluster），且標籤為 env:demo2-cluster

進入 Access Managerment > User Roles，點擊右上角的 CREATE NEW ROLE

創建 demo2-cluster-developer-readonly 角色，擁有連接ithome-202409-demo-2_demo2-cluster叢集的權限

version: v7
kind: role
metadata:
	name: demo2-cluster-developer-readonly # 創建的 Teleport Role 名稱
spec:
  allow:
    kubernetes_groups:
    - developer-readonly # 剛剛創建的 Group: “developer-readonly”
    kubernetes_labels:
      env: demo2-cluster # ithome-202409-demo-2_demo2-cluster 的標籤
    kubernetes_resources:
    - kind: pod
      name: '*'
      namespace: '*'
    node_labels:
      '*': '*'
    rules:
    - resources:
      - role
      verbs:
      - list
      - read

創建一個使用者 test-readonly 具有 demo2-cluster-developer-readonly 角色的權限

接下來要先在本機安裝 tsh 命令行工具

本機安裝 tsh & tctl 16.3.0 版本

Linux

# 首先，根據版本分配環境變數
$ TELEPORT_EDITION="oss"
$ TELEPORT_VERSION="16.3.0"

# 在要安裝 Teleport 的伺服器上下載並執行安裝
$ curl https://cdn.teleport.dev/install-v16.4.0.sh | bash -s ${TELEPORT_VERSION?} ${TELEPORT_EDITION?}

MacOS

$ curl -O https://cdn.teleport.dev/teleport-ent-16.3.0.pkg
$ sudo installer -pkg teleport-ent-16.3.0.pkg -target /
which teleport

Windows

要在 Windows 上安裝 tsh 和 tctl，請在 PowerShell 中運行以下命令（這些命令在 cmd.exe 中不起作用）：

# Set the desired teleport version
$ TELEPORT_VERSION="16.4.0"

# Set the TLS level to TLS 1.2 (required on Windows Server 2016 and lower)
$ [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Get the expected checksum for the Windows tsh package
$ Resp = Invoke-WebRequest https://cdn.teleport.dev/teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip.sha256

# PowerShell will return the binary representation of the response content
# by default, so you need to convert it to a string
$ [System.Text.Encoding]::UTF8.getstring($Resp.Content)

# <checksum> <filename>
$ Invoke-WebRequest -OutFile teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip -Uri https://cdn.teleport.dev/teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip
$ certUtil -hashfile teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip SHA256

# SHA256 hash of teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip:
# <checksum>
# CertUtil: -hashfile command completed successfully.

驗證校驗和匹配后，您可以提取檔案。可執行檔將在上 teleport-v$TELEPORT_VERSION-windows-amd64-bin\ 提供。

$ Expand-Archive teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip
$ cd teleport-v$TELEPORT_VERSION-windows-amd64-bin

$ .\tsh.exe version
# Teleport v$TELEPORT_VERSION git:v$TELEPORT_VERSION go1.22

$ .\tctl.exe version
# Teleport v$TELEPORT_VERSION git:v$TELEPORT_VERSION go1.22

確保將 tsh.exe和 tctl.exe 移動到PATH中。